CVE-2026-39820: Quadratic string concatentation in consumeComment in net/mail
Quadratic string concatentation in consumeComment in net/mail
Other sources
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39820?
CVE-2026-39820 is classified as a moderate severity vulnerability due to its potential for CPU exhaustion and memory allocation issues.
How do I fix CVE-2026-39820?
To fix CVE-2026-39820, update the golang/net/mail package to the latest version where the vulnerability has been addressed.
What impact does CVE-2026-39820 have on system performance?
CVE-2026-39820 can lead to significant performance degradation, causing excessive CPU usage and memory allocation during specific input handling.
Which versions of golang/net/mail are affected by CVE-2026-39820?
CVE-2026-39820 affects older versions of the golang/net/mail package prior to the vulnerability fix in later updates.
Can CVE-2026-39820 be exploited remotely?
Yes, CVE-2026-39820 can potentially be exploited remotely if an attacker sends specially crafted inputs to the affected functions.